6.5

CVE-2020-25015

Exploit
A specific router allows changing the Wi-Fi password remotely. Genexis Platinum 4410 V2-1.28, a compact router generally used at homes and offices was found to be vulnerable to Broken Access Control and CSRF which could be combined to remotely change the WIFI access point’s password.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Genexis ≫ Platinum 4410 Firmware Versionp4410-v2-1.28
   Genexis ≫ Platinum 4410 Version2.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.1% 0.861
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

http://packetstormsecurity.com/files/159936/Genexis-Platinum-4410-P4410-V2-1.28-Missing-Access-Control-CSRF.html
Third Party Advisory
Exploit
VDB Entry
https://www.getastra.com/blog/911/csrf-broken-access-control-in-genexis-platinum-4410/
Third Party Advisory
Exploit
https://www.jinsonvarghese.com/broken-access-control-csrf-in-genexis-platinum-4410/
Third Party Advisory
Exploit